{{- if and (.Values.global.modules.publicDomainTemplate) (.Values.prometheus.internal.alertmanagers.internal) }}
{{- range .Values.prometheus.internal.alertmanagers.internal }}
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: alertmanager-{{ .name }}
  namespace: d8-monitoring
  {{- include "helm_lib_module_labels" (list $ (dict "app" "alertmanager")) | nindent 2 }}
  annotations:
    {{- if eq (len $.Values.prometheus.internal.alertmanagers.internal) 1 }}
    web.deckhouse.io/export-name: "alertmanager"
    {{- else }}
    web.deckhouse.io/export-name: "alertmanager/{{ .name }}"
    {{- end }}
    web.deckhouse.io/export-icon: "/public/img/alertmanager.ico"
    {{- if and (ne (include "helm_lib_module_https_mode" $) "Disabled") $.Values.prometheus.auth.externalAuthentication }}
    nginx.ingress.kubernetes.io/auth-signin: {{ $.Values.prometheus.auth.externalAuthentication.authSignInURL | quote }}
    nginx.ingress.kubernetes.io/auth-url: {{ $.Values.prometheus.auth.externalAuthentication.authURL | quote }}
    {{- else }}
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/auth-secret: basic-auth
    nginx.ingress.kubernetes.io/auth-realm: "Authentication Required"
    {{- end }}
    {{- if $.Values.prometheus.auth.whitelistSourceRanges }}
    nginx.ingress.kubernetes.io/whitelist-source-range: {{ $.Values.prometheus.auth.whitelistSourceRanges | join "," }}
    {{- end }}
    {{- if $.Values.prometheus.auth.satisfyAny }}
    nginx.ingress.kubernetes.io/satisfy: "any"
    {{- end }}
    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
    nginx.ingress.kubernetes.io/configuration-snippet: |
      proxy_ssl_certificate /etc/nginx/ssl/client.crt;
      proxy_ssl_certificate_key /etc/nginx/ssl/client.key;
      proxy_ssl_protocols TLSv1.2;
      proxy_ssl_session_reuse on;
    nginx.ingress.kubernetes.io/affinity: cookie
    nginx.ingress.kubernetes.io/rewrite-target: "/$2"
spec:
  ingressClassName: {{ include "helm_lib_module_ingress_class" $ | quote }}
    {{- if (include "helm_lib_module_https_ingress_tls_enabled" $) }}
  tls:
  - hosts:
    - {{ include "helm_lib_module_public_domain" (list $ "grafana") }}
    secretName: {{ include "helm_lib_module_https_secret_name" (list $ "ingress-tls") }}
  {{- end }}
  rules:
  - host: {{ include "helm_lib_module_public_domain" (list $ "grafana") }}
    http:
      paths:
      - path: /alertmanager/{{ .name }}(/|$)(.*)
        pathType: ImplementationSpecific
        backend:
          service:
            name: {{ .name }}
            port:
              name: https
{{- end }}
{{- end }}
